Skip to content
OpenAdvisories

Package · Maven

io.netty:netty-codec-compression

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 8.7
    CVE-2026-59901

    Netty Bzip2Decoder: Infinite Loop in RLE State Machine Leads to Event-Loop Thread Hang

    Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the `Bzip2Decoder` handler in Netty's compression codec pipeline is vulnerable to a denial-of-service attack through a malformed bzip2 stre…

    netty netty druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  • High 7.5
    CVE-2026-42583

    Netty: Lz4FrameDecoder resource exhaustion

    Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Lz4FrameDecoder allocates a ByteBuf of size decompressedLength (up to 32 MB per block) before LZ4 runs. A peer only needs a 21-byte header plus comp…

    netty io.netty netty netty-codec-compression Debian Wolfi Maven